About bwooden

bwooden · ‎05-19-2011

Regarding st1: Is your app literally in "$SPLUNK_HOME/etc/deploymentapps/testapp" or is it in "$SPLUNK_HOME/etc/deployment-apps/testapp"? The hyphen is important but I thought perhaps that was a typo in your initial question.

bwooden · ‎05-19-2011

You can tweak acceptable parameters based on standard deviation or other stats. The below search will calculate the standard deviation of a and the existing average of a. Next we will make a null IF the value of a + standard deviation is greater than the average of a + standard deviation. Finally we filter out null values and return the average of what remains... ... | eventstats stdev(a) as stdev_a avg(a) as avg_a | eval a=if(a+stdev_a < avg_a+stdev_a, a, null()) | where isnotnull(a) | stats avg(a)

bwooden · ‎05-19-2011

There are a few ways to do it. From the GUI, you should also see a "Raw Events" as an export option along with json, xml, and csv. From the search language, there are several ways to do it as well. Here is one example that will export to a text file, $SPLUNK_HOME/var/run/splunk/results.txt outputtext usexml=false | rename _xml as raw | fields raw | fields - _* | outputcsv results.txt

bwooden · ‎05-19-2011

Try prepending your serverclass.conf with an empty global stanza. Whitelist is the default filter type so you may omit it if you'd like: [global] [serverClass:testapp] [serverClass:testapp:app:*] whitelist.0 = st2 restartSplunkd = true Alternate serverclass.conf... [global] [serverClass:testClass] whitelist.0 = st2 restartSplunkd = true [serverClass:testClass:app:testapp]

bwooden · ‎05-16-2011

For a scripted install you may find it easier to use the user-seed.conf to change admin's password on initial startup.

bwooden · ‎05-11-2011

As you've verified, the split can be achieved by quoting the intention. You should also be able to filter based on value of host_new, by switching search to where... index="tougou" sourcetype="network" | fields host,network_interface_name, bytes_sent_per_second, Bytes_Received_Per_Second | eval host_split=(split("$host_if$",":")) | eval host_new=(mvindex(host_split,0)) | where host=host_new | timechart max(bytes_sent_per_second), max(Bytes_Received_Per_Second) by host limit=50 useother=f Since where and eval use the same functions, you can actually combine those evals with the where... index="tougou" sourcetype="network" | fields host,network_interface_name, bytes_sent_per_second, Bytes_Received_Per_Second | where host=mvindex(split("$host_if$",":"),0) | timechart max(bytes_sent_per_second), max(Bytes_Received_Per_Second) by host limit=50 useother=f

bwooden · ‎05-10-2011

Is that the case if you quote "$host_if$" ?

bwooden · ‎05-08-2011

The HiddenSavedSearch currently shows results of a saved search and will not be influenced by time ranges. If you would like to search over a dynamic time - you might use the LinkSwitcher to show the HiddenSavedSearch in one child and the TimeRangePicker combined with a HiddenSearch in the second child. The TimeRangePicker will enable you to choose a time using the same time selection method used in the Search app on the flashtimeline and the HiddenSearch accepts this time range as part of its search criteria.

bwooden · ‎05-06-2011

This search would show a count of those servers: |stats count | eval host="Server1,Server2,Server3" | makemv delim="," host | mvexpand host | append [search sourcetype="wineventlog:security" (host="Server1" OR host="Server2" OR host="Server3")] | stats sum(eval(if(isnull(_time),0,1))) as count by host If there are many servers, it may be easier to maintain the list in a lookup file. Alternatively, if you want to show counts of all servers Splunk has seen you can lead with a metadata command and obviate the need to specify servers.

bwooden · ‎04-29-2011

I added a submit button to my original answer while updating the method a bit.

bwooden · ‎04-25-2011

I like it and edited my response to match. Thanks!

bwooden · ‎04-25-2011

Can you get the results you want with this search: earliest="@d" splunk_server="Splunk4-02" index="rnc" sourcetype="RNC" managedObject_class="WCEL" "HSDPALayeringCommonChEnabled" OR "HSUPAEnabled" | stats values(HSDPALayeringCommonChEnabled) as HSDPALayeringCommonChEnabled, values(HSUPAEnabled) as HSUPAEnabled, by distName host

bwooden · ‎04-25-2011

You've taken good steps in isolating the variable and trying a few different techniques. The difficulty you're experiencing may be related to 'events' vs 'results'. In the search app, you can switch between the event view, the event table, and the results table. Most searches pick the best view to use automatically. If you would just like to just see 4 results you could split by direction: sourcetype=sample009 | makemv delim=", " direction | stats count by direction To see 4 events you could invoke the mvexpand command: sourcetype=sample009 | makemv delim=", " direction | mvexpand direction

bwooden · ‎04-25-2011

Below is one way you could add the value of an input field to a lookup file... sandbox [edited to correct syntax] <module name="ExtendedFieldSearch" layoutPanel="panel_row1_col1"> <param name="field">Domain</param> <param name="default">foo.com</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="domain_addition"> <param name="prefix"> </param> <param name="fillOnEmpty">True</param> <param name="suffix"> </param> </param> </param> </param> <param name="replacementMap"> <param name="arg"> <param name="domain_addition"> <param name="value" /> </param> </param> </param> <module name="SubmitButton"> <param name="label">click to submit</param> <module name="HiddenSearch"> <param name="search">| inputlookup domains.csv | append [stats count | eval domain=trim("$domain_addition$") | fields - _time | fields domain] | dedup domain | outputlookup domains.csv</param> <module name="SimpleResultsTable" /> </module> </module> </module>

bwooden · ‎03-27-2011

You will not be able to lead with a pipe in a macro, per the macro docs... Note: if a macro definition includes a leading pipe character ("|"), you may not use it as the first term in searches from the UI. Example: "| metadata type=sources". The UI does not do the macro expansion and cannot correctly identify the initial pipe to differentiate it from a regular search term. The UI constructs the search as if the macro name were a search term, which after expansion would cause the metadata command to be incorrectly formed and therefore invalid. If you're using this from a View, you can still do this by leading the macro with a pipe... <param name="search">| `my_metadata_macro`</param> Or from the search app you can still type | `my_metadata_macro`

bwooden · ‎03-27-2011

This was a detailed (and more importantly, useful) answer. I kept trying to modify FieldPicker behavior before finally writing a module called StaticFieldPicker that doesn't know anything about underlying events and only knows about fields passed in through its param. It inherits HiddenFieldPicker to return 'results.fields' based on user selection. It was your mention of 'results.fields' and using Pulldown that motivated me to solve it that way. Somewhat related: I really dig on sideview_utils app too, despite not owning a Sideview t-shirt.

bwooden · ‎03-22-2011

I've reviewed some of the HiddenPostProcess literature previously made available on this site regarding intentions for a separate FieldSearch question. This is about FieldPicker though. I have a single HiddenSearch Search upstream from many HiddenPostProcess Searches which populate a veritable cornucopia of SimpleResultsTables. Is it possible for each SimpleResultsTable to have its own FieldPicker - and populate the list of that FieldPicker with only fields that make sense for its SimpleResultsTable. I am able to do this with multiple HiddenSearch Searches (one specially crafted for each SimpleResultsTable) but not using a HiddenPostProcess Search. Are there any methods available to use a HiddenPostProcess Search to update a Field Picker? <module name="HiddenPostProcess" layoutPanel="panel_row3_col1"> <param name="search">`_dashboard_x_y-matched`</param> <module name="Count"> <param name="options"> <list> <param name="text">10</param> <param name="value">10</param> </list> <list> <param name="text">20</param> <param name="selected">True</param> <param name="value">20</param> </list> <list> <param name="text">50</param> <param name="value">50</param> </list> <list> <param name="text">100</param> <param name="value">100</param> </list> </param> <module name="FieldPicker"> <param name="fields">user_id, field_a, field_b</param> <module name="SimpleResultsTable" group="Y Matched"> <param name="entityName">results</param> <param name="drilldown">all</param> <param name="allowTransformedFieldSelect">True</param>

bwooden · ‎03-03-2011

Are these log files available as text files? You could monitor them directly from a forwarder and have them sent directly to a Splunk indexer. You mentioned writing a program to gather the information. You may want to create a scripted input to query the logs if they are not lying around on disk ready to be consumed. You can run the scripted input from a forwarder and have it sent to an indexer.

bwooden · ‎03-03-2011

Are you trying to break your events & throw away just the last line of each event?

bwooden · ‎03-03-2011

Could you share a few events worth of data?

bwooden · ‎02-10-2011

Splunk will update your local/inputs.conf and local/outputs.conf to obfuscate passwords for certificate files. Splunk should not remove any options though. Would you be able to share a before and after of those two configuration files?

bwooden · ‎02-10-2011

How were you dropping the first five lines? Have you tried something like this: props.conf [source::.../PHY_Short_CSW_CMA.csv] TRANSFORMS-nullq = nullQ REPORT-csv = phy_csv transforms.conf [nullQ] REGEX = ^[^,]+$ DEST_KEY = queue FORMAT = nullQueue [phy_csv] DELIMS = "," FIELDS = "No.","time","CSW-1D.CACHE-1CA","CSW-2J.CACHE-1CA","CSW-1D.CACHE-2CC","CSW-2J.CACHE-2CC"

bwooden · ‎02-08-2011

You can not automatically call an eval out of the box using transforms.conf. You could create a macro though to minimize your typing. Instead of typing ... | eval some_var=<some eval opeartion> you would type ... `macro_name` Wildcards are not currently supported in lookups but you do have a few options. You can create a scripted input to do it. You can use event types. You can leverage the search language (note: the below example would need to be updated for different mask bits) ... | rex field=ip "(?\d{1,3}.\d{1,3}.\d{1,3}.)" | strcat cidr_test "0/24" cidr_test | eval cidr=if(cidrmatch(cidr_test,ip),cidr_test,null) | where isnotnull(cidr) | lookup cidr OUTPUT location | search location="home_office"

bwooden · ‎12-11-2010

You could create an eventtype to group useragent values and filter against that eventtype in several searches. Then you could maintain the one eventtype centrally. You could also achieve this by creating a lookup for useragent where useragent.csv is: useragent, boolean_exclude bot, true feed, true spider, true and your search is: ... | lookup useragent.csv useragent OUTPUT boolean_include | where isnull(boolean_exclude)

bwooden · ‎12-11-2010

authentication.conf instructs Splunk how to validate user credentials and authorize.conf instructs Splunk as to what users are allowed to do. If you copy both from the .../local path of a known good configuration and re-start Splunk, it should work on the new instance as well

Posts	308
Solutions	72
Karma Given	233
Karma Received	370
Member Since	‎03-02-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Can the Oracle Wallet be used for DBX authenticati...

How would someone set Splunk environment variables...

Time picker on form is not honored in "open in sea...

Do I need to escape a pipe character for TIME_FORM...

Error while configuring Check Point OPSEC LEA Linu...

Searchhead Pooling: Failed to lock sentinel.txt w...

May I center an x-axis label?

How to update FieldPicker for a SimpleResultsTable...

Checking http port [80]: already bound ERROR: The ...

Re: Help with Deployment Server and Client? Step-b...

Re: Statistics Related

Re: Export results to .txt

Re: Help with Deployment Server and Client? Step-b...

Re: Windows Splunk - difficulty changing default p...

Re: why is eval not taking value of Parameter from...

Re: why is eval not taking value of Parameter from...

Re: change scheduled search timerange with timeran...

Re: Include zero count in stats count

Re: Has anyone been able to create a form search t...

Re: Has anyone been able to create a form search t...

Re: mvexpand limited results to 10000 events

Re: Makemv example not working

Re: Has anyone been able to create a form search t...

Re: metadata search in a macro doesnt seem to work

Re: How to update FieldPicker for a SimpleResultsT...

How to update FieldPicker for a SimpleResultsTable...

Re: Is there documentation of writing a "forwarder...

Re: Transforms REGEX will not search past first li...

Re: Transforms REGEX will not search past first li...

Re: Splunk overwrites outputs.conf and inputs.conf...

Re: How to not index first X lines in CSV file ??

Re: adding lookup or eval to transforms.conf

Re: access_combined hide certain useragents

Re: LDAP Authentication - Adding LDAP User in Splu...

Join the Conversation